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Abstract — New measures of multipartite entanglement are 
constructed based on two definitions of multipartite information 
and different methods of optimizing over extensions of the states. 
One is a generalization of the squashed entanglement where 
one takes the mutual information of parties conditioned on the 
state's extension and takes the infimum over such extensions. 
Additivity of the multipartite squashed entanglement is proved 
for both versions of the multipartite information which turn 
out to be related. The second one is based on taking classical 
extensions. This scheme is generalized, which enables to construct 
measures of entanglement based on the mixed convex roof of a 
quantity, which in contrast to the standard convex roof method 
involves optimization over all decompositions of a density matrix 
rather than just the decompositions into pure states. As one 
of the possible applications of these results we prove that any 
multipartite monotone is an upper bound on the amount of 
multipartite distillable key. The findings are finally related to 
analogous results in classical key agreement. 

Index Terms — Squashed entanglement, c-squashed entangle- 
ment, Mixed convex roof, Multipartite distillable key 

I. Introduction 

Many bipartite entanglement measures are known, but few 
are known for multipartite states. Among the known bipartite 
entanglement measures, the squashed entanglement is distinct 
from other measures in its additivity and interesting construc- 
tion [1], [2]. It is based on quantum conditioning. In general, 
we do not know how to condition upon a quantum register. 
However if a function is built out of entropies, then there is 
a more or less magic way of conditioning, which is based on 
the fact that, accidentally, conditioning classical entropies can 
be represented by subtracting the conditioning entropy from 
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the joint entropy - the entropy of the state on A conditioned 
by the state on B can be written formally as 



S{A\B) = S{AB)-S{B). 



(1) 



Quantum conditional entropy often takes negative values. 
However, squashed entanglement is built out of the quantum 
mutual information, which remains positive upon conditioning. 
The definition of squashed entanglement is inspired by the 
intrinsic information, a quantity used in classical cryptography. 

Interestingly, no multipartite generalization of this measure 
was proposed so far. In this paper we propose two gener- 
alizations, based on two versions of the multiparty mutual 
information. One of these mutual information generalizations 
was considered already in [3], [4], while the second one, 
a kind of dual to the latter, was introduced in [5]. The 
authors considered both generalizations of mutual information 
to multipartite setting as so-called secrecy monotones. Thus it 
is natural to use both to generalize squashed entanglement. We 
prove that our multipartite versions of squashed entanglement 
are additive. 

In the definition of bipartite squashed entanglement [2], one 
considers conditional mutual information over extensions of 
the original state pab to a third system E. We do the same 
in the multipartite case. The conditioning here is quantum: 
the system E is a quantum register that means the extension 
state is quantum-correlated between AB and E. This kind 
of conditioning is applicable only to linear combinations of 
quantum entropies. 

On the contrary, we know how to condition any function 
upon a classical register E. Here a question arises: for which 
functions, can we obtain a measure of entanglement based 
on classical conditioning? In this paper we also attempt to 
answer this question and show that if the function / satisfies 
the following conditions 

i) / is invariant under local unitary transformations 

ii) / does not increase under local measurement on average 
then, via conditioning, it gives rise to an entanglement mea- 
sure. The measure turns out to be of similar construction 
to the convex roof [6], where one optimizes over all pure 
decompositions of a given state. Here we instead consider 
decompositions into mixed states (see e.g. [7], [8], [9]), 



E{p)= inf 

l^i PiPi=p 



(2) 



Such a construction is called the mixed convex roof. This 
approach works in both bipartite as well as the multipar- 
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tite scenario. If the function is the mutual information, we 
have then two measures, the original squashed entanglement 
{q-squashed entanglement) and the classical squashed (c- 
squashed) entanglement. It should be mentioned that for 
bipartite systems the latter measure was already considered in 
[1] as an interpolation between entanglement of formation and 
squashed entanglement. It was also independently proposed 
in [7], [10], however, monotonicity of this measure was not 
proved. Within our approach, the c-squashed entanglement is 
a special case of mixed convex roof measures, hence it is 
monotonous. 

We also discuss asymptotic continuity of our entanglement 
measures. In particular, multipartite squashed entanglement is 
shown to satisfy this condition, which comes from the Alicki- 
Fannes result [11] (cf. [2]). On the other hand the measures 
based on mixed convex roof inherit the asymptotic continuity 
from the original functions [8]. 

The rest of the paper is organized as follows. Section [TT] 
briefly recalls the construction of bipartite squashed entan- 
glement. Section [Til] discusses two formulas of multipartite 
mutual information, then defines their conditional versions and 
explores their properties. Section [IV] presents two multipartite 
entanglement measures. One is the q-squashed entanglement 
that is based on conditioning on a quantum register, which 
is the generalization of bipartite squashed entanglement. We 
consider two versions of q-squashed entanglement, based on 
two different formulas of multipartite mutual information. We 
prove additivity for both versions. The other entanglement 
measure is the c-squashed entanglement that uses condition- 
ing on a classical register. It can also be obtained via the 
mixed convex roof. Asymptotic continuity is also discussed. 
In Section [V] we show that any multipartite monotone that 
satisfies reasonable axioms is an upper bound on distillable 
key, providing q-squashed entanglement as an example. It 
is a direct generalization of a bipartite result given in [12], 
based on the multipartite key distillation protocol given in 
[13]. In Section [V-D| we consider the classical analogue of the 
latter fact, that has been already presented in [5]. We consider 
here more carefully the issue of asymptotic continuity and the 
presence of the eavesdropper. Section [Vl]provides a summary. 

II. Bipartite squashed entanglement 

In this section, we briefly recall the definition and properties 
of the original squashed entanglement. It is based on a simple 
quantity - the quantum mutual information, 

I(A : B) = S(A) + S(B) - S(AB), (3) 

where S(X) is the von Neumann entropy of system X. Then 
one defines the conditional mutual information as 

I(A : B\E) = S{AE) + S{BE) - S(ABE) - S(E), (4) 

by simple application of the definition Eq. (Q]i to the mutual 
information. The entanglement measure is then obtained by 
"squashing". 

Definition 1 For a given state pab, squashed entanglement 
is given by 

E sq (p AB ) = ^MI(A:B\E), (5) 



where the infimum is taken over all extensions Pabe of the 
original state. 

The factor 1/2 is taken just for convenience and an extension 
is any joint state pab e such that tracing out the state on E 
leaves pab on AB. 

Squashed entanglement satisfies not only the basic prop- 
erties of entanglement measures - monotonicity under local 
operations and classical communication (LOCC), but also 
other useful properties, notably additivity. It is also a good 
upper bound for distillable entanglement. 

III. Conditional multipartite mutual information 

In this section, we discuss the mutual information for 
multipartite states and then study the properties of conditional 
multipartite mutual information. 

There are at least two candidates for multipartite mutual 
information. One is more in the spirit of the Venn diagram 
representation of information-theoretic identities [14], where 
the bipartite mutual information corresponds to the intersection 
of two sets. To extend this notion to the multipartite case, we 
would need to take the intersection of all sets. For example 
in the tripartite case this approach would give the following 
candidate for mutual information 

S(A) + S(B) + S(C) - S(AB) - S(AC) - S(BC) + S(ABC). 

(6) 

This function can however be negative. The other approach, 
which produces a much simpler function, is to notice that 
mutual information is the relative entropy between the state 
and its marginal 

I(pab) = S(pab\\pa <8> Pb), (7) 
where the relative entropy is defined as 

S(p\\a)=trp(logp-loga). (8) 
Thus multipartite mutual information would be 

I{A:B:C) = S(pabc\\pa®Pb®Pc)- (9) 

This turns out to be a very simple function considered by 
Lindblad [3] and used in [4] to describe correlations within 
multipartite quantum systems: 

m 

I(A 1 : .1. : ... : A m ) = £ S(A Z ) - S(A X A 2 . . . A m ). (10) 

?:=i 

In this paper we will adopt this function as one measure of 
multipartite mutual information. Since it can be represented 
as the relative entropy between a state and the product of its 
marginals, it is a monotone under local operations (because of 
the monotonicity of relative entropy [15], [16]). 

This version of multipartite mutual information has yet 
another interesting feature [5]: it can be represented as a sum 
of bipartite mutual information 

J(Ai : A 2 : ... : A rn ) = I(A 1 : A 2 ) + I(A 3 : A X A 2 ) 

+I(A 4 : A1A2A3) + ... I(A m : A X A 2 . . . A m ^). (11) 
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S(ABC) 




Fig. 1 . A graphical representation of entropic quantities for the case of three 
parties. Here, the region that represents I(A : B) is r + u. S3 = r + s + t + u 
and I {A : B : C) = r + s + t + 2u 

Put in a different way, / satisfies the recurrence relation 

I(A 1 :A 2 :...:A m ) = I(A 1 : A 2 : ... : A m -i) 

+I(A m :A 1 ... A m -x). (12) 

So it is actually a very simple quantity, which is built as 
follows: first we consider the (original) mutual information 
between two chosen parties. Then we want to take into account 
the next party, so we take the mutual information between it 
and the previous two parties. In general, to take into account 
a new party means to add the mutual information between 
this party and all the other ones (treated jointly). Moreover 
this quantity is independent of the selected order in which we 
combine them. It is also obvious that the expression is invariant 
under permutation of the systems. The fact that multipartite 
mutual information can be decomposed into bipartite mutual 
information already indicates that most of the proofs for the 
original mutual information in the bipartite case can be applied 
to multipartite case without great modification. 

There is yet another formula for mutual information in 
the multipartite case, as proposed in [5], where multipartite 
secrecy monotones were considered. It is of the form 

m 

S m = S{pA u ...,A i - U A i+ - L ,...,A m ) - ( m _ l)S'(/9A 1 ... J 4 m )- 

i=l 

(13) 

It has an alternative expression in terms of conditional mutual 
information [5] (cf. Eq. [TTJ: 

S m = I(A 1 :A 2 ...A m )+I(A 2 :A 3 ...A m \A 1 ) 
+I(A 3 : A 4 ...A m \A 1 A 2 ) + ... 
+I(A m _ 1 :A m \A 1 ...A m _ 2 )- (14) 

It turns out that the two candidates for mutual information, / 
and S m are dual to each other: 

S m +I(A 1 : A 2 : ... : A m ) 

m 

= I(Ai : Ax . . . A t -iA i+ i . . . A m ), (15) 



i.e. they add up to the sum of all bipartite mutual information 
between a single system and the rest. In the case of bipartite 
systems, both candidates are equal to the bipartite mutual 
information. 

In the following section we will show that both mutual infor- 
mation formulas can be used to construct a good entanglement 
monotone. 

Before we define the entanglement measure, let us discuss 
the problem of conditioning. In general, we do not know what 
it means to condition upon a quantum register. However it 
turns out that if a function is a linear combination of entropies, 
one can condition such a function using a mysterious prescrip- 
tion for conditioning entropy: 

S(A\B) = S(AB)-S(B). 

This quantity can be negative, however it has a good inter- 
pretation [17]. For linear combination of entropies, we apply 
this formula to each term. Such conditioning is well defined, 
in a sense that the result of conditioning does not depend on 
how we have represented the function in terms of entropies, 
e.g. a function f{AB) = S{A) + S(AB) - 2S{AB) has 
the same conditioned version as in the case it is written as 
f(AB) = S(A) - S(AB). This way of conditioning is rather 
blind, and it does not tell us how to do it in the case of other 
functions. 

Note that this conditioning reduces to the usual one when 
the register E is classical. Another interesting feature is the 
following 

f(A 1 ,...,A m \EE') = f((A 1 ,...,A m \E)\E'), (16) 

for / a linear combination of entropies and the right hand 
side has the following meaning: we first compute the function 
f(A\, . . . , A m \E). It is again linear combination of entropies, 
so one can apply to it conditioning again. Thus conditioning 
is associative. 

Since conditioning does not depend on how we decompose 
the function into entropies, we get that the conditional mutual 
information is a sum of conditional bipartite mutual informa- 
tion. For example we have: 

I(A 1 : A 2 : . . . \E) = I(A 1 : A 2 \E) + I(A 3 : A 1 A 2 \E) 

+ ... + I(A m :A 1 ...A m _ 1 \E). (17) 

Let us examine properties of both mutual and conditional 
mutual information in the multipartite case. We will provide 
here two properties that were proved in [2] for the bipartite 
case. It would be very convenient to have a chain rule, 
however, we do not have it. In place of the chain rule we 
have two identities that still prove useful: 



Proposition 1 The following identities hold for multipartite 
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mutual informations. 

I(XA 1 A m ) = 

m 

I{A 1 :...:A m \X) + Y,I(X--A i ), (18) 

i=2 

I(XA 1 A m ) = 

III 

J(Ai 1,„; • )^/:.V .1 ... (19) 

i=2 

S m (XA 1 : . .. : A 

S m (Ai A m \X) +I(X:A 2 ... A m ), (20) 

S m (XAi A m ) = -I(A 2 : . . . : A m ) 

m 

+ J2 IiAi ■XA 1 ... A^Ai+r . . . A m ). (21) 

i=2 

Moreover conditional mutual informations are additive. 

Proof. To get identities for / one uses repeatedly the chain 
rule for bipartite mutual information that asserts I(XY : Z) = 
I(X : Z) + I(Y : Z\X), and Eq.Cjj} and Eq.©. Eq. ^ 
follows directly from definition (Q~3). The last identity (see [5]) 
follows from Eqs. dTZb and ( fT5] >. 

Additivity follows from the fact that conditional mutual 
informations are linear combinations of entropies which are 
additive. 

We now immediately get basic monotonicity properties of 
mutual information (both / and S m ), which are enough to 
ensure that "squashing" will produce a function that will be a 
monotone under LOCC. 

Proposition 2 The following statements hold. 

(i) Mutual informations do not increase under local condi- 
tioning, 

I(XA 1 :...:A m )>I(A 1 :...:A m \X), 
S m {XA 1 A m ) > SM : . . . : A m \X). (22) 

(ii) Conditional mutual informations do not increase under 
local operations, 

I{A 1 :...:A m \E)>I{k{A 1 ):...:A m \E), 

S m {A x A m \E) > S^(A(Ai) : . . . : A m \E), (23) 

where A(-) is a local operation on subsystem A\ (a trace- 
preserving completely positive map). 

Proof. The statement (i) follows from Eqs.(fT8l (l20l , and 
the fact that bipartite mutual information is nonnegative. 
The statement (ii) comes from two facts: one is that any 
local operation can be realized in the unitary representation 
aQ (pq) = tr RURQ(\0)(0\)n®PQU} iQ and I(-\E) is invariant 
under local unitary operation and adding ancilla; the other fact 
is that 

I(XA 1 A rn \E) > I{A X : . . . : A rn \E). (24) 

To get Eq.(l24b. we apply conditioning to both sides of Eq.(fT9l 
and using associativity of conditioning obtain 

I(XA 1 :...:A m \E) = I(A 1 :...:A m \E) 

rn 

+ J2 I (X:A i \A 1 ...A i . 1 E). (25) 

i=2 



Then, the required inequality follows from the fact that bi- 
partite conditional mutual information is nonnegative. Just 
by conditioning (f2Tb we get the statement (ii) for S m . This 
completes the proof. | 

IV. Multipartite squashed entanglement 

In this section we will define two squashed measures 
and prove that they are monotones under LOCC. One is 
the q-squashed entanglement when the extension register is 
quantum. The other is the c-squashed entanglement when the 
extension register is classical. 

A. Monotonicity of entanglement measures under LOCC 
First we review what is meant by a monotone under LOCC. 

Definition 2 A function E is called a LOCC monotone if it 
satisfies the following condition: 

E(p AB )>J2PiE(cr i AB ), (26) 

i 

where i are outcomes of the LOCC operation, pi are proba- 
bilities of outcomes, and o\ B is the state given that outcome 
i was obtained. 

We have the following proposition [18]. 

Proposition 3 A convex function f does not increase under 

LOCC if and only if 

[LUI] / satisfies local unitary invariance 

f{U A ®U BPAB U A ®U B ) = f{p AB ), (27) 
[FLAGS] / satisfies 

fC£,PiPAB ® \i)x(i\) - £>Mb), (28) 

i i 

for X = A' , B' where \i) are local, orthogonal "flags". 

B. Q-squashed entanglement 

Now we define the multipartite q-squashed entanglement as 
follows 

Definition 3 For the m party state p Alt ..., Am 

E q sq { PM ,..., Am ) = infill :A 2 :...: A m \E), (29) 

where the infimum is taken over states (J Al ,.... Am ,E that are 
extensions of p Al ,...,A m , Tr^er = p. 

Alternatively, one can use S m . We will perform all proofs for 
/, however we will use only Proposition |2l as well as the 
fact that if the register E is classical, then conditioning upon 
it regains its usual meaning. Thus all results are valid also 
for S m , so that it gives rise to an independent definition of 
multipartite squashed entanglement. 

The measures we propose reduce to twice the original 
squashed entanglement in the case of two parties. It resembles 
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in some respect relative entropy distance from the set of 
completely separable states, i.e. states of the form 

^Pif? Al ® ■■■®f?A m - (3°) 

i 

Namely, it attributes nonzero entanglement to states that do not 
contain true multipartite entanglement, such as many singlet 
pairs. It is immediate to show that E q q satisfies condition LUI. 
In the following we will show that it is convex, and satisfies 
FLAGS. 

Convexity. Consider two states pA 1 ...A m an d <JA 1 ...A m , and 
their arbitrary extensions pA 1 ...A m E and UA 1 ...A m E- We have 

E q sq (pp Al ...A m + (1 ~ p)(t Ai ...aJ < I(Ai . ..A m \EE') T 

(31) 

with 

TA 1 ...A m EE' = PP Al ...A m E ® |0)e'(0| 

+ (l-p)(TA 1 ...A m E®\l)E'(l\. (32) 

This is because the latter state is an extension of the state 
pp + (1 — p)a. However, since register E' is classical, the 
conditioning is reduced to the usual one, so that we have 

I(A 1 . . . A m \EE') T = P I(A 1 . . . A m \E) p 

+ (l-p)I(A 1 ...A m \E) a , (33) 

where we have used associativity of conditioning. Since we 
can choose arbitrary extensions of p and a, we get that right- 
hand-side can be arbitrary close to pEj q (p) + (1 — p)E g q (a). 
This proves convexity. | 

FLAGS. We decompose the condition into two inequalities. 
The inequality 

E q sq {Y,PiPM...A m ® \i)x(i\) < Y^P^Mm-aJ (34) 

i i 

follows from convexity (which we have just proved) and from 
invariance of E q sq under adding local pure ancilla. The latter is 
obvious, since any extension of a state pA x ...A m ® |0)a' 1 (0| is 
of the form pA 1 ...A m E® Wl A' x (0| where pA 1 ...A m E is extension 
of pA x ...A m - (Then it follows from additivity of entropy.) 
The converse inequality 

E q sq (£PiPM...A m ® \i)x(i\) > Y^P^UPm.-aJ (35) 

i i 

can be interpreted as non-increasing upon conditioning under 
the local classical register. We have 

E q sq (£2piP Al ...A m ® \i)x(i\) = inf I(XA X A m \E) r , 

(36) 

where r is the extension of the state J2iPiP Al A m ® \i)x(i\- 
Now we dephase register X. Since it is a local operation, 
according to Prop. [2] the conditional mutual information can 
only go down. Thus we have 

I(XA 1 A m \E) T > I(XA 1 : . . . : A m \E) f > 

> I{A X A m \EX) f = J^Pi^Ai ■■■■■■ A m \E) Ti 

i 

^^(Wi-aJ. (37) 



where f is the dephased version of r and r, is the dephased 
version of r, given X = i, which is still a valid extension 
of our state. The second inequality comes from Prop. [2] The 
equality comes from the fact that after dephasing the register 
is classical. | 

From the definition of E^ q , we can see that no assumption 
on the classicality of register E is made. So generally the 
register E is quantum-correlated with system A\ . . . A m in the 
extensions. What about the case when we allow only classical 
registers in the extensions i.e. the register and the system is 
classically correlated? Can it still be a monotone under LOCC? 
The answer is yes. This comes from the result that we know 
how to condition any function upon classical registers. In fact, 
we will show that mutual information is just a special case 
immediately obtained from a general theorem. 

Remark: In a recent paper [19], the bipartite squashed 
entanglement was given an operational interpretation in terms 
of communication rate in state merging. In [20], the multi- 
partite q-squashed entanglement on /,„ with the factor 1/2 
was developed independently and was related to the outer 
bound on the communication rate in multiparty distributed 
compression. To find a similar situation for the mutipartite 
q-squashed entanglement on S m is an open question. 

C. Additivity of q-squashed entanglement 

In this section we show that the two versions of multipartite 
q-squashed entanglement are additive on tensor product and 
subadditive in general. Namely it turns out that the main 
ideas behind the proof of additivity of bipartite squashed 
entanglement can be carried over to multipartite case. We will 
show explicitly the proof for three parties. The generalization 
of n parties is immediate. 

The main ingredient is the following lemma. 

Lemma 1 

I(AA' : BB' : CC'\E) =I(A:B: C\A'B'C'E) 
+I(A' : B' : C'\E) + 1 (A : B'C'\A'E) 
+I(B : A'C'\B'E) + I(C : A'B'\C'E), (38) 

S 3 (AA' : BB' : CC'\E) = S 3 (A : B : C\A'B'C'E) 
+S 3 (A' : B 1 : C'\E) + I(AB : C'\A'B'E) 
+I(AC : B'\A'C'E) + I(BC : A'\B'C'E). (39) 

Proof. 

I(AA' : BB' : CC"\E) - I(A : B : C\A'B'C'E) 

-I{A' : B' : C'\E) 
= S(AA'E) + S{BB'E) + S{CC'E) 
+3S(A'B'C'E) - S(AA'B'C'E) - S(BA'B'C'E) 
-S(CA'B'C'E) - S(A'E) - S(B'E) - S(C'E) 
= S{AA'E) + S{A'B'C'E) - S{AA'B'C'E) 
-S{A'E) + S(BB'E) + S(A'B'C'E) 
-S(BA'B'C'E) - S{B'E) + S{CC'E) 
+S(A'B'C'E) - S(CA'B'C'E) - S(C'E). (40) 
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S 3 (AA' : BB' : CC"\E) - S 3 {A : B : C\A'B'C'E) 
-S 3 (A' : B' : C'\E) 

= S(AA'BB'E) + S{AA'CC'E) + S{BB'CC"E) 
- S(ABA'B'C'E) 

-S(ACA'B'C'E) - S(BCA'B'C'E) + 3S(A'B'C'E) 

-S(A'B'E) - S(A'C'E) - S(B'C'E) 

= I(AB : C'\A'B'E) + I(BC : A'\B'C'E) 

+ I{CA: B'\C'A'E)., (41) 

Since conditional mutual information is positive, we obtain 
immediately 

Corrolary 1 

I(AA' : BB' : CC'\E) >I{A:B: C\A'B'C'E) 

+I(A' : B' :C'\E), (42) 

S 3 (AA' : BB' : CC"\E) > S 3 {A : B : C\A'B'C'E) 

+S 3 (A' :B':C'\E). (43) 

The lemma Q] allows also to prove: 

Lemma 2 Conditional I and £3 are additive. For product 

states pabce ® pa'B'CE' 

I(AA' : BB' : CC'\EE') = I{A:B: C\E) 

+I(A' : B' : C'\E'), (44) 

S 3 {AA' : BB' : CC'\EE') = S 3 (A : B : C\E) 

+S 3 {A' : B' : C'\E'). (45) 

Proof. From lemma Q] we get 

I(AA' : BB' : CC'\EE') = I(A:B: C\A'B'C'EE') 
+I(A' : B' : C'\EE') + I(A : B'C'\A'EE') 



+ I(B : A'C'\B'EE') + I{C : A' B'\C EE'), 

=0 =0 
= I{A:B: C\E) + I(A' : B' : C'\E'). (46) 

The last three terms vanish because the state is a tensor 
product: the primed systems are not correlated with the non- 
primed. Similarly: 

S 3 {AA' : BB' : CC'\EE') = S 3 {A:B: C\A'B'C'EE') 
+S 3 {A' : B' :C'\EE') + I(AB : C'\A' B' EE') 



+ I(AC : B'\A'C'EE') + I(BC : A'\B'C EE') 

V v ' " v ' 

=0 =0 
= S 3 (A : B : C\E) + S 3 (A' : B' : C'\E'), (47) 

which ends the proof. An immediate conclusion from the 
corollary Q] and lemma |2] is that E1 q based on either of the 
mutual informations is additive. 

Proposition 4 For any n-partite states p and a, 

E* q (j>®v)=E* q {p)+E2 9 (<r). (48) 



From Corollary Q] it follows that E q sq is superadditive, 

E! q (p 12 )>E* q ( Pl )+E* q (p 2 ), (49) 
where the subscripts denote two n partite systems. 

D. Entanglement measures via mixed convex roof 

In this subsection, we prove a theorem that provides a 
method of constructing entanglement measures via mixed 
convex roof. 

Definition 4 A mixed convex roof of a function g is given by 
E g (p)=izd^Pi9(pi), (50) 

i 

where infimum is taken over all ensembles {pi,Pi} satisfying 
T^iPiPi = P- 

Remark: In [8] it was shown that if g is continuous, then 
there exists a finite decomposition that realizes the infimum. 
Moreover it was shown, that if g is asymptotically continuous, 
then so is its mixed convex roof (which is a generalization of 
[21]). 

Theorem 1 For any continuous function g which is a mono- 
tone on average under local operations, its mixed convex roof 
is monotonic under LOCC. 

Let us recall that to prove monotonicity of multipartite 
squashed entanglement we have used two features of mutual 
information proven in proposition [2] monotonicity under local 
operations, and monotonicity under local conditioning. Note 
that those two features, if we consider only conditioning upon 
classical register, are equivalent to monotonicity on average 
under local operations. 

Proof. First, it is immediate to see that E g is convex. 
It remains to show that also E g is monotone under local 
measurements, on average [22]. We will simply show that 
for any given measurement, if g does not increase under 
this measurement for any state, E g does not either. Consider 
arbitrary state p with optimal decomposition {pi, pi] (if there 
does not exist such ensemble, we can take a nearly optimal 
one, and the proof still goes through). The measurement 
transforms the state p into ensemble: 

P^Uk,&k} (51) 

and the members pi of the optimal ensemble into ensembles 
{Qk\i> ^i^}- Th us Qk\i is the probability of obtaining outcome 
k provided the state pi was sent. The probability that pi was 
sent, if outcome k was obtained is given by q^ k = Piqk\i/<lk- 
Note that 

^Qilk^k = a k- (52) 

i 

Now we have 

E g(p) = ^2Pi9{Pi) > ^Pi^1k\i9{^k) 

i i k 

= ^2qk^2q l \k9(^k ) ) > ^2qkE g (a k ). (53) 

k i k 
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The first equality comes from the fact that the ensemble 
{Pi, Pi} is optimal, whose existence is guaranteed by con- 
tinuity of g (see above remark). The first inequality comes 
from monotonicity of g under the considered measurement. 
The last inequality, comes from the fact that } is 

some ensemble of o~k (it follows from Eq.(|52ll). This completes 
the proof. | 

A new entanglement measure can be constructed via mixed 
convex roof if a function satisfying the condition of the 
theorem is found. An example illustrating the theorem is that 
one can take as g the function J c , defined as supremum of 
mutual information of the joint probability distribution after 
Bob and Alice's measurement. That is 

Ic(pab) = sup H(p A ) + H(p B ) - H(p AB ), (54) 

aIa^bJb, 

where p l AB = trAi ® BipabA\ ® B\. Another one is the 
c-squashed entanglement defined below. 

E. C-squashed entanglement 

Multipartite c-squashed entanglement is defined as follows. 

Definition 5 For the m party state pa x A m 

E c 3q (p Au ...,A m ) = mf I(A t : .1, : ... : A m \E), (55) 

where infimum is taken over the extension states CAi,....A m .E 
of the form Y^PiPAi...A m ® l*M*l- 

It is clear that E c sq is nothing but the entanglement mea- 
sure obtained by mixed convex roof of multipartite quantum 
mutual information function. We have seen that multipartite 
quantum mutual information satisfies the conditions of the 
theorem. This function was considered in [7] in the context 
of distillation of private key. Its bipartite version was also 
presented in [1], [10]. By the theorem, we get that it is indeed 
a good entanglement measure. The measure is related to the 
q-squashed entanglement: it is obtained, if in the definition of 
"squashing", one restricts to extensions such that the auxiliary 
system is classical. 

Of course by replacing / with S m we obtain another version 
of c-squashed entanglement. In bipartite case, it coincides with 
the previous one. 

F. Asymptotic continuity 

In this subsection, we prove the asymptotic continuity of 
E] q and E- q . 

Definition 6 Let f be a real-valued function f defined on 
states pi, p2 acting on Hilbert space C d and e = \\pi — P2\\i- 
Then a function is asymptotically continuous if it fulfils the 
following condition 

V PuP2 \f(pi)-f(p2)\<K 1 e\ogd + 0(e), (56) 

where K\ is constant and 0(e) is any function, which satisfies 
lim e ^o 0(e) — > and depends only on e. (In particular, it does 
not depend on the dimension). 



Proposition 5 The multipartite q-squashed entanglement 
E1 q (A\ . . . A m ) and c-squashed entanglement 
Eg q (A\ . . . A m ) are asymptotically continuous. 

Proof. The asymptotic continuity of Ej q (Ai . . . A m ) comes 
from Eq.dT7l> and Alicki-Fannes result [11] that asserts I(A : 
B\E) is asymptotically continuous and d = d A - The asymp- 
totic continuity of E^ q (Ai . . . A m ) comes from the fact that 
the mixed convex roof of a function inherit the asymptotic 
continuity of that function [8]. 

G. Lockability property 

In this subsection, we will calculate squashed entanglement 
for the multipartite flower state and show that multipartite 
squashed entanglement is lockable. A quantity, usually some 
measure of correlations, is lockable if it can drop by an 
arbitrary amount when only a single qubit of a local system 
is lost . This property has previously been observed for 
many correlation measures such as accessible information, 
entanglement cost and logarithmic negativity [23], [24], [25]. 
The bipartite squashed entanglement has been proved to be 
lockable in [26]. Here we adapt the proof to the multipartite 
case. First we generalize the flower state to multipartite case. 

Definition 7 A tripartite flower state paa'bb'cc is defined 
through its purification state \&) AA' BB'CC'X of the form, 

\$) AA'BB'CC'X = 
-= £ \i) A \j)A'\i)B\j}B>\i}c\j) c"Uj\i)x, (57) 

3 = 0,1 

where Uq = I and U\ is a Fourier transform. 

Proposition 6 For the tripartite flower state, E^ q (AA' : 
BB' : CC) = 3+logd, E c sq (AA' : BB' : CC) = 3+|logd 
for the version I 3 and E] q (AA' : BB' : CC") = E c sq (AA' : 

BB' : CC) = 3+logdfor S 3 while E q s { q c) (A : BB' : CC) = 
for both I3 and S3. 

Proof. The minimization over state extensions paa'bb'cc'z 
in squashed entanglement is equivalent to a minimization over 
CPTP channels A : X — > Z, acting on the purifying system 

X for PAA'BB'CC 

PAA'BB'CC'Z = [id-AA'BB'CC ® A)$ AA' BB' CC X ■ (58) 

Now we use the result proved in [26] that asserts for the 
bipartite flower state oaa 1 b b' '■ 

S(AA'Z) + S(BB'Z) - S(AA'BB'Z) - S(Z) > 2 + logd, 

(59) 

where the equality can be reached by trivial Z (i.e. Z is 
product with the rest) or by Z = X, or finally, by measuring 
Z in basis {\i}}. 

For the q-squashed ^3, 

I(AA' : BB' : CC'\Z) = AA' Z + BB' Z 
+CC'Z - AA'BB'CC'Z - 2Z 
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= -[AA'Z + BB'Z - AA'BB'CC'Z - Z] (60) 

- 11 V ' 

>2+logd 

+ - [BB'Z + CC'Z - AA'BB'CC'Z - Z] (61) 

- " V ' 

>2+logd 

+ - {CC'Z + AA'Z - AA'BB'CC'Z - Z] (62) 
2 v. ' 



>2+logd 



1 



+ - [AA'BB'CC'Z - Z] 
2 v . ' 

>-S{AA'BB'CC') = - log d 

> 3 + logo?, 



(63) 



(64) 



where we omitted S() for brevity. Ineqs. (l60b,(f6Tb and 
d62l come from Ineq.tO and the facts that S P (AA'Z) = 
Sp(BB'Z) = S P (CC'Z) = S a (AA'Z) = S a {BB'Z) and 
S P (AA'BB'CC'Z) = S a (AA'BB'Z), Ineq.tgU) from the 
subadditivity of von Neumann entropy. It is easy to check 
that I(AA' : BB' : CC"\Z) = 3 + logd if the extension state 
is the purification one. 

If the register is classical, then paa'BB'CC'z is necessarily 
separable in AA'BB'CC : Z. Therefore Ineq.([63) should be 
replaced by [S(AA' BB'CC Z) - S{Z)\ > 0. On the other 
hand, if paa'bb'ccz is the state after the measurement on 
X in the basis {|1), • • • , \d)}, then the bound is achieved. So 



E 



q _i_ J 

sg ° ~ 2 



log d. 



For the q-squashed S3, 

S(AA' : BB' : CC"\Z) = AA'BB'Z + BB'CC' Z 



-+ 


-CC'AA'Z - 2AA' BB'CC Z - 


- Z 




= i [AA'BB'Z 


■f BB'CC Z - AA'BB'CC'Z 


-z] 


(65) 


+ - [BB'CC Z 


>2+Iogd 






+ CC'AA'Z - AA'BB'CC'Z 


-z] 


(66) 


+ - [CC'AA'Z 


>2+logd 






+ AA'BB'Z - AA'BB'CC'Z 


-z] 


(67) 



>2+logd 

+- [Z - AA'BB'CC'Z] (68) 
2 <- v ' 

>-S{AA'BB'CC')=- logd 

>3 + logd, (69) 

where again we omit S() for brevity. The above inequalities 
hold for similar reasons. One also can check that S(AA' : 
BB' : CC'[Z) = 3 + logo? if the extension of the state is 
trivial (i.e. the state itself tensored with some state of Z) that 
also means the c-squashed entanglement is equal to the q- 
squashed one. 

On the other hand, Pabb'CC is separable, so 
Eiq C \pABB'CC') = for both versions. This shows 
that the multipartite squashed entanglement is lockable. | 

The results can be straightforwardly generalized to the Tri- 
partite flower state. In particular for I m , we have E'' = m + 



\ogd, and E c sq = 
E s q = m + \ogd. 



logd, while for S m we have B| 



Remark: It is notable that during the proof, the q-squashed 
entanglement of flower state is achieved by the purifying 
register for I 3 that is necessarily quantum (the equality in 
Ineq.d63]l holds only if AA'BB'CC'Z is in a pure state), while 
by trivial extension for S3 that can be classical. Moreover 
the c-squashed entanglement can be arbitrarily larger than the 
q-squashed one. This gives the negative answer to the open 
question: " Is q-squashed entanglement equal to c-squashed 
entanglement for the version of I m ?" for the multipartite case. 
For the bipartite case, we cannot see it from the flower state. 
Note that quite recently Brandao [27] has proved that E£ 
and E1 q are different even in bipartite case, for antisymmetric 
Werner states. Now, one can also ask, whether the two 
versions of squashed entanglement, coming from S m and I m 
respectively, are different from each other. For pure states and 
the flower states, we see that q-squashed entanglement is equal 
for two versions. Are these two versions the same in the end? 
We don't know now. But as we have shown, for c-squashed 
entanglement the two versions are different. We then guess, 
that also for q-squashed entanglement they are different. 

V. Multipartite axiomatic monotones as an upper 

BOUND ON DISTILLABLE KEY 

In this section we will show, that the quantum squashed 
entanglement is an upper bound on multipartite distillable 
key [13]. We will do this by proving that a wide class of 
entanglement monotones, which satisfy some natural axioms 
are upper bounds on distillable key. That is we generalize 
the results of [12] (see also [28]) to a multipartite case. We 
also revisit the analogous result within the so called classical 
key agreement framework [29] (see also [30], [31]), that has 
been given in [5]. There, an even a more general approach has 
been developed: the rates of transition between the probability 
distributions under LOPC operations are considered, and the 
classical multipartite secrecy monotones are shown to govern 
these rates. In section IV-Dl we show again that the classical se- 
crecy monotones are upper bounds on classical distillable key, 
addressing more carefully the issue of asymptotic continuity 
and consider more explicitly the presence of the eavesdropper. 

In what follows, we will use a short-hand notation for mul- 
tipartite systems. In particular A\ . . . A m we denote as (m) A 
We will assume that A; = AiA\ and sometimes we denote 
(m)A more explicitly as (m)AA'. We denote also Ai . . . A m 
as (m)A and A[ . . . A' m as (m)A' . Following this rule, the 
Hilbert space <8>. . MTL^ will be denoted as Hi m \^, and 

(n) (n) m 

ItX <g) . . . (g)7iV which is isomorphic with the tensor product 

1 m (n) 

of n copies of rl^ m ^, as Consequently, the state p of 

such system will be denoted as Pf m \^- Analogously we mean 
P( m ) A > as acting on B(n^ m ) A >) = b\h.a' x ® ■ ■ -®UA' m ) and 
P( m )A as the state acting on B(7i^ A ) = B{TLa 1 ® ■ ■ ■ <S> 
HaJ. 

A. Multipartite key distillation 

Let us first recall the definition of multipartite distillable key 
in the context of private quantum states [32]. It was introduced 
in [32] and is studied in [13], as a direct generalization of the 
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bipartite case. Namely, instead of twisted maximally entangled 
bipartite states, the parties have to distill a twisted GHZ state, 
so that m-partite private dit has a form: 

1™ = E jli-^O'-il ® UiPA^A.Jj], (70) 

where L/j are some unitary operations acting on T~La' ,...,a> ■ 

The optimal rate of key distilled by means of LOCC 
operations from n copies of the input state is the multipartite 
distillable key, which is denoted as Kp \ Let us note here, 
that in what follows, for technical reasons we will denote by 
m the number of parties of a multipartite state and by n the 
umber of copies of the state. More formally, we have: 

Definition 8 For any given state pf m \A *= ^0^(m)A) ^ et 
us consider a sequence P n of LOCC operations such that 
P n{P?" )A ) = °n- A set of operations V = U™ =1 {P n } is 
called a pdit distillation protocol of state p^ m ^A if there holds 

lim ||0n-7*>||=O, (71) 
n — *oo 

where is a multipartite pdit whose key part is of dimension 
d n x d n . 

For a protocol V, its rate is given by 

K{V) = lim sup i^I-A (72) 
The distillable key of state p^ m ^ is given by 

K^\ P{m)A )^su P nV). (73) 



Remark 1 In Sec. W-C\ we will show that the maximization 
in the definition of can be restricted to protocols 

whose communication complexity grows at most linearly in 
the number of copies of the initial state Pi m )AE U emma 
\3}. Moreover, the optimal yield can be obtained with the 
use of a number of systems ( needed for implementing local 
operations), that grows also linearly in the number of the 
input copies (remark^. Hence, if d = dimW/ m w B < 00 
then the dimension of the output of the protocol is bounded 
by log dim < cnlogd, for some constant c. 

B. Upper bounds from monotonicity 

Following the paper by Ekert et al. [12], we know that a 
function is an upper bound on distillable key Co, if it satisfies 
some natural axioms. Their proof can be generalized to the 
multipartite case, as it does not depend on the number of 
parties. Actually, the only fact which is needed here is that 
there is a protocol P with the property that on the n copies 
of the m-partite state pr m \j^, satisfying 

\\ P(m)A -lin<t (74) 

that uses only linear communication (in the number of copies 
of p) and has a rate close to logd (i.e. logd — /(e) with / 
vanishing as e approaches zero). More formally it is stated in 



the theorem below a multipartite version of the Corollary 3.2. 
from [12]. 

Theorem 2 Let M(p) be a function mapping (tn)-partite 
quantum states p = pt m )AA' into the positive numbers such 
that the following holds: 

1) Monotonicity: M(A(p)) < M(p) for any LOCC opera- 
tion A. 

2) Asymptotic continuity: for any states p n ,a n acting 
on W^l^, the condition \\p n — a n \\ — ► implies 

j^\M(p n ) - M(<7")| - where r n = dimWg^. 

3) Normalisation: M(jW) > i . 

Then the regularisation of the function M given by M°° (p) = 
limsupjj^^ — — — - is an upper bound on K D , i.e., 
M°°{p(m)AA<) > K^ n) (p {m)AA ,) for all p( m ) A A> with 
dimW, , 1 < 00. If in addition M satisfies 

(rn)A J J 

4. Subadditivity on tensor products: M{p® n ) < nM(p), 
then M is an upper bound for K^'. 

Proof. This theorem follows as a corollary from the 
multipartite version of the theorem 3.1. of [12]. Since the 
proof of the multipartite version does not differ from the one 
for the tripartite case, we refer the reader to [12]. We note 
however, that the latter proof uses the fact stated in lemma 
A.l. of [12]. We provide in section [V^Cl an analogous lemma 
in the multipartite case - which proves the first statement of 
our remark [T] We show there that the amount of classical 
communication needed by an optimal key distillation protocol 
is linear in the number of systems n. 

We note here also that the proof given in [12] based 
implicitly on the fact that only communication can increase 
the dimension of the support of the output state of an optimal 
key distillation protocol. Although this fact does hold, as it 
can be proved directly using quantum information techniques, 
we provide shorter argumentation in Remark |2] ■ 

Exampie 1 ( multipartite squashed entanglement as an upper 
bound on distillable key) 

As an example of the application of theorem [2] we show 
here that the normalized multipartite squashed entanglement 
is an upper bound on the distillable key: 

^ sq (p)>K^\p). (75) 

To see this we observe that this monotone easily fulfils the 
conditions (12}, (T3 and (4) of theorem^ as is shown in sections 
\IV-B\IV-F\ and l/V-CI respectively. What remains to check the 
normalization condition which we show in the observation 
below. 

Observation 1 For any natural m > 2 there holds: 
E! q ( 7 $)>mlogd. 

Proof. The proof is just a direct generalization of that given 
in [28] for the bipartite case (m = 2). In what follows we fix 
a natural m > 3 arbitrarily. 

We consider a state P( m )AA' = ) ® P(m)A' an d 

its extension to system E pt m )AA' e = P< We have also 
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7 = %n)AA'E = U ® I B(/'(mMA'B)t r1 ® Ie> where J7 = 

53f=o N • •■£)(*■■• i| <E> U^ A is a twisting operation. 
We then have the following facts: 

1) 

S{{m)AA'E) 1 = S((m)AA'E) p 

= S((m)A'E) p = S((m)A'E) 7t , (76) 

where 1 \ m)A ' E = U^ )A ' ®l E (p (rn)A , E ){U^ A ^ ®I E . 
2) S(E) 7i = S{E) 7 , where lE (if) denotes the E 
subsystem of l( m )AA'E 

3) 

V iel ,..., TO SiA^E^ = logd+Y, jSiA'iE)^. (77) 

fc=0 

The first fact is obvious due to unitarity relations between 
P( m )AA'E and j( m )AA'E, as well as p (m)A , and ^ m)A . The 
second one is just a consequence of the fact that if = j E - 
The third one follows from the fact that the Aj A^E subsystem 
is a cqq state and from the joint entropy theorem [33]. 

Having established these facts, the argumentation is straight- 
forward. Let E be the fixed extension. By definition of the 
squashed entanglement [1], [2] we have: 

E%{ 1 ^)=iniI{{m)AA'\E) 1 

m 

= mi[Y^S{A i A' i E) 1 

i=l 

- (m - l)S(E) 7 - S({m)AA'E) 7 ] 

m d—1 ^ 

= mlogd + M[J2 1 £- [ S(A! i E^ k (78) 

i=l fe=o 

- (m - l)S(E) 7 - S({m)AA'E)A 

d — 1 1 m 

= m log d + 2 E C79) 

fc=0 i=l 

-(m-l)S(%-S(H^)] 

d-l ^ 

= mlogd + inf^-I((m)A'|S) 7Ji (80) 

fc=0 

>mlogd. (81) 

In equality (|79l l we have used the fact (O while in (f80b 
the facts ([TJ and (f2j). The last inequality is thanks to the 
positivity of conditional multipartite mutual information. Since 
the choice of m > 3 was arbitrary, we have proved the lemma. 

C. Linear communication cost of optimal multipartite key 
distillation 

In this section we show, that, as in the bipartite case, an 
optimal key distillation protocol needs only a linear amount 
of communication. To this end, we use the following theorem, 
that is proved in [13]: 

Theorem 3 For any state Pr m \ A of the systems (m)A with 
Ai = AiA'p there is a protocol V with a rate: 

Kl{p(m)A) > min/^i : M)*, - HM ■ E)^, (82) 



where ip p is a purification of the state p^ m ^\ to system E. 
On n input copies the protocol V uses cn bits of classical 
communication, for some constant c > 0. 

Remark 2 Another property of the protocol given in [13], is 
that it uses the ancillary systems to implement local operations 
with dimension that is only linear in the number of input states 
n. To see this, we just observe that the party which broadcasts 
to the other parties does not need any ancillary systems, and 
the remaining m — 1 parties needs no more of them than the 
rate of the key, which is clearly linear in n. 

We can give now the final lemma which proves the state- 
ment from remark Q] This is a modified version of the lemma 
A.I., given in [12]. 

Lemma 3 (Comp. lemma A. 1. [12]). 

The maximization in the definition K^ 1 ^ can be restricted to 
protocols that use communication at most linear in the number 
of copies of p(m)AA> ■ This implies that if Aim. H/ m w = d < oo 
then dimH;^.^ < cn log d, where c is a constant independent 
of d and n. 

Proof. In what follows we directly reproduce a bipartite proof 
given in [12]. 

Let {A n }„ e N be a key distillation protocol (with communi- 
cation not necessarily linear in n) with rate R. For any fixed 
e > 0, there exists an uq such that 

IIAno(^)V)- ^ )A \U <e, (83) 

£ 

and —2- > R — e. Consider now key distillation from 

n — 

many copies of a [m)AE := A(A na (p®™° AA ,)), where A is 
a measurement of Alice and Bob in their computational bases 
followed by tracing out the systems (m)A' (and the same 
for Bob). Using Fannes' inequality [34] we can bound the 
difference in the mutual informations by 

min/(^ 1 : A t )^ - I{A l : E)^ > l na - 4rf„ - 677(e), (84) 

where tp a is a purification of the state a. As it is assured 
by theorem [3j Alice and Bob are now able to achieve a rate 
min,Ji I{A\ : A^^^ — I{A\ : E)^ a using communication 
linear in the number of copies of av m )^, We therefore have 
modified the protocol {A n } n6 pj achieving a rate R into a 
protocol {A„}„ 6 n with a rate 

R> (l-ce)(R-e)-^Q. (85) 

The amount of communication needed is proportional to the 
number of copies of P( m )AA'- Since e was arbitrary we obtain 
a sequence of protocols (with communication linear in the 
number of copies p( m )AA') approaching the rate R. ■ 

D. Analogous results for multipartite classical key agreement 

In this section we will consider the analogous result to 
the ones given in theorem [2] in the realm of classical key 
agreement [29], [30], [31], that has been found in [5], Within 
this paradigm, the distillable key from an m + 1 -partite 
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distribution is the amount of key that can be obtained in 
the asymptotic limit from the n realizations of a distribution 
via local operations and communication between to parties 
(m)A which is public i.e. listened to by the m + 1-th party - 
Eve, per copy of a distribution. We will show that a function 
of an m + 1-partite distribution, which satisfies axioms of 
monotonicity, continuity, normalization and subadditivity, is an 
upper bound on the amount of secure key that can be distilled 
from the m + 1 partite distribution {distillable key). 

In what follows P( m )A will denote a distribution defined on 
X(m)A = XAi x ... x XA m - The n such distributions resides 
consequently on x t a 1 x ■ ■ ■ x XA m > which is denoted as X? m )A- 
Analogously, Xa' x . . . x x\' x E 1 will be denoted as x7 m )A'E- 

For the sake of completeness of the presentation, we begin 
with definition of an LOPC protocol: 

Definition 9 An LOPC protocol V is an family {A}„ of 
classical channels A„ : {x? m \AE) ~~ * X(m)A'E' w ^ich are 
a finite number of concatenation of local operations (local 
channels) and public communication steps (communicating 
some number to one honest party and the eavesdropper). 

We pass now to definition of distillable secure key, that is 
the key that can be obtained from a given distribution via an 
(optimal) LOPC protocol: 

Definition 10 We say that LOPC protocol V is a classical key 
distillation protocol for a distribution P( m )A € X{m)A> if 

lim \\A n (P (rn) A® n ) - K l Cm)A \\ = 0, (86) 

where KV^ A = ■ . ■ i m )^ii...i m ® Pe is me ideal key 

distribution on X{m)A> for some distribution Pe of the eaves- 
dropper. The rate of a protocol is given by 

K(T) = lim sup (87) 

n — >oo Tl 

Then the classical distillable key of a distribution Pr m )A is 
defined as supremum of the rates 

c { S l \p {m)A ) = BM V n{v). (88) 

V 

Consequently, we have the following theorem: 

Theorem 4 (See also a general result of [5]) Let M be a 
function mapping m+l-partite classical distributions (defined 
on Xm = X\ x ... x x\ x Xe) in* positive numbers such 
that there holds: 

1) Monotonicity: M(k(P)) < M(P) for any LOPC oper- 
ation A. 

2) Asymptotic continuity: for any distributions P n , Q" de- 
fined on Xm' tne condition \\P n — Q n \\ — > implies 
T -L-\M(P n )-M{Q n )\ -> where r n = dimx™ and 
A{ = AiA^. 

3) Normalisation: M(K^K A ) > i . 

Then the regularisation of the function M given by M°°(P) = 
hmsup^^oQ — — — '- is an upper bound on C D , i.e., 

M°°{P( m )AA') > Cd '{P(m)AA') for all P (m)A A' with 
dim x m < 00 • If i R addition M satisfies 



4. Subadditivity on tensor products: M{P® n ) < nM(P), 

then M is an upper bound for C^. 

Proof. The proof of this theorem is in full analogy to that 
of the theorem |2] hence we do not present it here. It needs 
however the facts analogous to that from remark [TJ which we 
present below. 

We first argue, that the maximization in the definition of the 
distillable key can be taken over the protocols which 

have only linear amount of communication. To prove this, 
we observe, that the quantum multipartite Devetak- Winter 
(D-W) protocol provided in [13] can be applied also in the 
classical case, with appropriate change of quantum operations 
to classical data processing operations. Such modified quantum 
multipartite D-W protocol we will call a classical multipartite 
D-W protocol. 

The quantum multipartite D-W protocol, as a multipartite 
extension of the Devetak- Winter protocol, works for multipar- 
tite ccq states. It is easy to see that is essentially classical i.e. 
can be done with help of local classical operations and public 
communication. Indeed, instead of quantum POVM's that are 
used by the honest parties in this protocol [35], [13], one can 
consider classical operations, that are based on the classical 
Slepian-Wolf theorem [14]. Moreover, if some amount of key 
can be obtained from the multipartite ccq state, then it can 
be also obtained from this state after projecting onto Eve's 
subsystem turning it into a classical state. For this reason, the 
classical multipartie D-W protocol applied to the probability 
distribution gains at least that much of secure key, as the 
quantum one. Since the quantum multipartite D-W protocol 
uses only a linear amount of communication, so will the 
classical one (see lemma [3)- 

We argue now, that the dimension of the ancillary system 
used to implement local operations in the classical multipartite 
D-W protocol is also linear in the number of input copies. This 
holds by the same property of the quantum D-W protocol, that 
has been noted in remark |2] 

In summary, we have that the dimension of the output 
variable of the honest parties is only linear in the number 
of input copies. This ends the proof of the above theorem. 

Remark 3 Note that from [12] it follows that the above 
theorem holds for a special class of distributions. These are 
distributions for which Eve's distribution is a function of 
Alice's and Bob's joint distribution. Unfortunately, one can not 
follow this approach to extend the results to all distributions. 
This is because there are distributions for which Cd 7^ Kd- 
For this reason we can not use directly the " 'unified formalism " 
given in [12] to get the result. 

Exampie 2 (multipartite intrinsic information as an upper 
bound on classical distillable key) We will show now, that 
there holds: 

J -±^I(( m )AlE)p>C ( S l) {P), (89) 

where P is some distribution of variables (to) A As in case 
of the multipartite squashed entanglement, we merely check 
that this function satisfies the axioms of the above theorem. 
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In what follows, we will not assume, that the multipartite 
intrinsic information is realized on a particular variable E, 
which seems however to be true due to it being true for the 
bipartite intrinsic information (see [36]). 

Asymptotic continuity.- It is noted in [5], that the multipartite 
intrinsic information is simply continuous in its argument (a 
weaker condition than that of asymptotic continuity). The 
asymptotic continuity of this function follows from general 
result contained in proposition 2 of Ref. [8] as explained in 
the bipartite case in section V.B of [8] (see also [37]). The 
reason is the same as in the case of mixed convex roof: the 
operation of "arrowing" preserves asymptotic continuity, and 
the continuity of conditional multipartite information follows 
from the Fannes inequality [33]. 

Monotonicity. -The monotonicity of the multipartite intrinsic 
information for the case where Eve is in a product state 
with the honest parties is shown in [5]. It is also noted 
there that in the general case the monotonicity also holds 
and the proof is a direct generalization of the monotonicity 
proof they have provided, hence we just briefly sketch the 
idea, for completeness of presentation. To show monotonicity 
under local operations, it remains to rewrite the multipartite 
intrinsic information in terms of bipartite conditional mutual 
information and use the chain rule for the latter. Then, the 
data processing inequality assures that the function can not 
increase. To see that communication can not increase it ei- 
ther, it is enough to see that it can be rewritten as if only 
Eve had the communication. It is then clear that discarding 
such information can only increase the multipartite intrinsic 
information. 

Normalization. -Since for the multipartite intrinsic informa- 
tion there is a representation given in Eq. ( TPTI i. it is easy to 
see that on the ideal distribution K X °^ AE it takes value: 

m 

I(Kffi A \K%< d ) = E S ( A ^ ~ S((m)A) = (m - 1) logd, 

i=l 

(90) 

where d is the dimension of the support of A±. Hence, by 
theorem H we get that j-^I((m)A J. E) > . 

Example 3 A similar result is true also for another monotone 
which is a version of S m extended to m + 1 systems which we 
denote following [5] as S m |. 

S m |:= inf \I(A X :A 2 ...A m \E) 

E->E 

+I(A 2 :A 3 ... A m \A 1 E) + I{A 3 : A 4 . . . A^A^E) 
+ ... + I{A m _ t : A m \A m _ 2 . . . A 1 E)}.. (91) 

To get rid of the infimum, we realize S m J, via the sequence of 
channels E — > E n . Then for each n we observe that each term 
as in the above sum is just a difference of mutual informations. 
E.g. I{A 2 :A 3 ... A m \E n ) = I(A 2 : A 3 . . . A m E n ) - I(A 2 : 
E n A\), that forms a 'pair'. It is then easy to see, that apart 
from the first such 'pair' which equals log of the dimension 
of the support of A\, all the others are equal to zero. Hence 
we have that 

S m l>C { ™\ (92) 



VI. Conclusions 

In summary, we present two new multipartite entanglement 
measures, the generalized q-squashed entanglement and the 
c-squashed one. There were obtained by squashing the con- 
ditional multipartite mutual information over the extension 
states (i.e. taking the infimum). When the ancilla register 
is quantum we get the q-squashed entanglement, and when 
it is classical we get the c-squashed one. Each measure 
has two versions corresponding to two possible multipartite 
mutual informations / and S m . The q-squashed entanglements 
are additive, while for the c-squashed additivity is an open 
question. 

Notice that we consider two types of correlation between 
the system and the ancilla in the extension states - completely 
quantum correlation and classical correlation. Suppose now 
that we allow only the extensions of the form Y^PiPAi a ® 
<fi E where <p E is an unnecessarily orthogonal states. That is we 
restrict the extension to separable states between the system 
and the ancilla. Is it still a good entanglement measure by 
squashing? The answer is yes. As a matter of fact, one can 
check that the proof of monotonicity of E$ q can be applied 
to any convex extension set. For example one can allow the 
extension to be PPT state between the system and the ancilla. 
We thus have a whole family of entanglement measures. 

We have shown also, that any multipartite entanglement 
measure which satisfies reasonable axioms, is an upper bound 
on the multipartite distillable key Krj. Using this fact we 
proved that q-squashed entanglement is an upper bound on 
K E . It is not difficult to see that the same holds for the 
regularized mixed convex roof of the function I c . We also 
revisit the analogous result in the classical realm given in [5], 
addressing more carefully the issue of asymptotic continuity, 
as well as the presence of the eavesdropper. 

Note added: After completing this manuscript we have 
noticed a paper by G.A. Paz-Silva and J.H. Reina, 
quant-ph/0702177 which also proposed a procedure to build 
entanglement measures based on mixed convex roof. Also, we 
have got to know, that Patrick Hay den and Ivan Savov have 
independently proposed a multipartite version of squashed 
entanglement. 
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